Operation DragonReturn DcRAT Injection - MixedSvc Spawning svchost.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects malicious process injection behavior attributed to Operation DragonReturn, where an illegitimate executable named 'Mixed Reality.exe' located within a 'Windows Media Player' directory spawns 'svchost.exe'. This activity is indicative of a DcRAT payload attempting to inject fileless .NET code into a legitimate system process using techniques such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.